CVE-2012-2721

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-27 · updated 2026-06-16
Weakness: CWE-264

Description

The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote attackers to bypass access restrictions and possibly have other unspecified impact.

Affected products

Moshe Weitzman Organic Groups: 6.x-2.0, 6.x-2.0-rc1, 6.x-2.0-rc2, 6.x-2.0-rc3, 6.x-2.1, 6.x-2.2 (+2)

References

http://drupal.org/node/1619736
http://drupal.org/node/1619810
http://drupalcode.org/project/og.git/commitdiff/1485708
http://secunia.com/advisories/49397
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82728
http://www.securityfocus.com/bid/53838
https://exchange.xforce.ibmcloud.com/vulnerabilities/76150
http://drupal.org/node/1619736
http://drupal.org/node/1619810
http://drupalcode.org/project/og.git/commitdiff/1485708
http://secunia.com/advisories/49397

Get alerted when CVE-2012-2721 or the next vulnerability affects your stack